Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-66579
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66578
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66577
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66576
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66575
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-66574
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66573
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66572
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66571
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
|
7.1 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-62108
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
|
9.8 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-62104
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
|
10.0 Critical | — | 0,86% | 17 Sep 2026 |
|
CVE-2026-62101
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
|
9.8 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-14850
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this pr...
|
8.8 High | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-92932
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetc...
|
5.1 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-92921
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can rec...
|
4.9 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-92920
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Att...
|
5.4 Medium | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-92919
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows de...
|
8.1 High | — | 0,58% | 17 Sep 2026 |
|
CVE-2026-92918
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the...
|
8.8 High | — | 0,65% | 17 Sep 2026 |
|
CVE-2026-92904
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID w...
|
4.3 Medium | — | 0,34% | 17 Sep 2026 |
|
CVE-2026-81481
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...
|
7.5 High | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-92925
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying exte...
|
7.1 High | — | 0,40% | 17 Sep 2026 |
|
CVE-2026-92917
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode,...
|
7.5 High | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-92916
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default),...
|
7.5 High | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-92915
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login re...
|
7.3 High | — | 0,42% | 17 Sep 2026 |
|
CVE-2026-92914
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against a...
|
8.1 High | — | 0,48% | 17 Sep 2026 |
|
CVE-2026-92913
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairi...
|
7.4 High | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-92912
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to appr...
|
6.5 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-92860
A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of...
|
9.1 Critical | — | 0,85% | 17 Sep 2026 |
|
CVE-2026-90823
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An una...
|
9.8 Critical | — | 0,68% | 17 Sep 2026 |
|
CVE-2026-90822
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An u...
|
9.8 Critical | — | 1,4% | 17 Sep 2026 |
|
CVE-2026-81480
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access coul...
|
7.2 High | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-81479
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could po...
|
5.5 Medium | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-81478
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote ac...
|
9.8 Critical | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-81477
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could...
|
7.2 High | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-81476
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v...
|
9.8 Critical | — | 0,95% | 17 Sep 2026 |
|
CVE-2026-81475
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with...
|
9.8 Critical | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-81441
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with...
|
5.5 Medium | — | 0,11% | 17 Sep 2026 |
|
CVE-2026-81440
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access c...
|
9.8 Critical | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-78296
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.
This issue affects FluentAuth: from n/a through 2...
|
5.3 Medium | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-92903
Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as mu...
|
8.2 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-92893
A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the s...
|
4.3 Medium | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-92611
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule inste...
|
4.8 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-81474
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could p...
|
7.8 High | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-81439
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could po...
|
6.5 Medium | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-81438
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit...
|
7.5 High | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-66269
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerabil...
|
7.5 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-92894
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs...
|
4.3 Medium | — | 0,26% | 17 Sep 2026 |
|
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO...
|
8.8 High | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-78427
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Sinc...
|
5.3 Medium | — | 0,24% | 17 Sep 2026 |
|
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged...
|
2.0 Low | — | 0,19% | 17 Sep 2026 |